[HIGH] security(android): clear custom headers between calls

[OskarEichler]

Security impact

RNAppAuthModule keeps register, authorize, and token custom-header maps in module fields. parseHeaderMap previously updated only groups present in the next call. A call for provider A with a credential-bearing header followed by a call for provider B that omitted that group therefore reused and sent provider A's header to provider B. This can disclose API keys or authorization credentials across provider trust boundaries without concurrent calls.

Fix

Clear all three stored header groups before parsing every call. Each invocation now receives only the headers explicitly supplied for that invocation. This is intentionally isolated from the separate concurrent interactive-flow state fix and prefetch deadlock fix.

Breaking / observable change

Applications that accidentally relied on omitted header groups inheriting values from an earlier call must now provide those headers on every call. Reusing credential headers implicitly is unsafe.

Verification

• Android demo library compile: BUILD SUCCESSFUL
• Existing Jest suite: 3 suites / 81 tests pass
• Existing ESLint suite passes
• git diff --check passes

The repository has JavaScript and Expo-plugin tests but no Android native unit-test target, so this four-line native state reset is covered by the Android compilation plus the existing regression suites rather than adding unrelated test infrastructure.

A patch changeset is included.

[changeset-bot]

🦋 Changeset detected

Latest commit: 5487680

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.